CVE-2024-6394

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-6394

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6394.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-6394

Published

2024-09-30T08:09:10.169Z

Modified

2026-07-15T01:49:02.938899374Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Local File Inclusion in parisneo/lollms-webui

Details

A Local File Inclusion vulnerability exists in parisneo/lollms-webui versions below v9.8. The vulnerability is due to unverified path concatenation in the serve_js function in app.py, which allows attackers to perform path traversal attacks. This can lead to unauthorized access to arbitrary files on the server, potentially exposing sensitive information such as private SSH keys, configuration files, and source code.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6394.json",
    "cna_assigner": "@huntr_ai",
    "cwe_ids": [
        "CWE-29"
    ]
}

References

Affected packages

Git / github.com/parisneo/lollms-webui

Affected ranges

Type

GIT

Repo

https://github.com/parisneo/lollms-webui

Events

Introduced

8a8e3a1c386321f641a014bf8f7029512ccad411

Last affected

8a8e3a1c386321f641a014bf8f7029512ccad411

Database specific

{
    "cpe": "cpe:2.3:a:lollms:lollms_web_ui:9.8:*:*:*:*:*:*:*",
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "9.8"
        },
        {
            "last_affected": "9.8"
        }
    ]
}

Affected versions

9.*

9.8

v9.*

v9.8

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6394.json"